[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Interagency Report on the Status of International Cybersecurity Standardization for the Internet of Things (IoT):

-  Restricting logical access to the network and network activity. This may include using unidirectional gateways, a demilitarized zone network architecture with firewalls to prevent network traffic from passing directly between the corporate and IoT networks, and having separate authentication mechanisms and credentials for users of the corporate and IoT networks. An IoT system should use a network topology that has multiple layers, with each layer's security considered separately, so that all communication occurs with as much security and reliability as afforded by the technology. -  Restricting physical access to IoT network and components. Unauthorized physical access to components could cause serious disruption of an IoT system's functionality. A combination of physical access controls should be used, such as locks, card readers, and/or guards. -  Protecting individual IoT components from exploitation. This includes deploying security patches as expeditiously as possible, after testing them under field conditions; disabling all unused ports and services and assuring that they remain disabled; restricting IoT user privileges to only those that are required for each person's role; tracking and monitoring audit trails; preventing RF attacks and restricting physical access; and using security controls such as antivirus software and file integrity checking software where technically feasible to prevent, deter, detect, and mitigate malware. -  Preventing unauthorized modification of data. This includes data that is in transit (at least across the network boundaries) and at rest. Methods such as encryption and digital signatures can be used to preserve the integrity of data. -  Detecting security events and incidents. Detecting security events, which have not yet escalated into incidents, can help defenders break the attack chain before attackers attain their objectives.

Interagency Report on the Status of International Cybersecurity Standardization for the Internet of Things (IoT)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.1 (NIST 3.2.1)?

[Assistant]
According to Security Property Verification by Transition Model:

3.2.1. 3.2.1.

Security Property Verification by Transition Model


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Standard Security Label for GOSIP_ an Invitational Workshop:

- open system A set of one or more computers, the associated software, peripherals, terminals, human operators, physical processes, information transfer means, etc., that forms an autonomous whole capable of performing information processing and/or information transfer which complies with the requirements of OSI standards in its communication with other open systems. [3]

- A. Yes, but more work is needed. The Electronic Systems Division of the U.S. Air Force plans to fund a feasibility study of the Multipolicy Machine via a Small Business Innovation Research (SBIR) Phase I grant to Data Security Inc. Starting in July 1991, we will explore these and other issues
- Q. Several national and international agencies (ECMA and ISO, for example) are working on sensitivity label standards to make information interchange easier between MLS systems. Can the Multipolicy Machine incorporate these evolving standards? - A. Yes. The Multipolicy Machine fits very nicely with the European standards. 4. Qe Can we design a Multipolicy Machine which is simple to manufacture, evaluate, and accredit? Can commercial offthe-shelf components be used? - A. I hope the answer to both questions is yes, but need more time to engineer the technology. - Q. How much more complicated will it be to evaluate multiple instead of single policy machines? - A. Although initially more difficult, it will eventually be easier to evaluate multiple policy machines than single policy machines because the policy will be separate from the mechanisms. Now, policy and mechanisms are integrated and must be evaluated together. When rule-based or other machines which separate policy from mechanism are accepted, it will be sufficient for the vendor to prove to the evaluators that their mechanisms implement any of a set of security policies. Proving that the particular policy of a particular installation is valid and supported by the mechanism is left to the certification and accreditation process
- Q.

Standard Security Label for GOSIP_ an Invitational Workshop


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Guide to Bluetooth Security:

| NIST SP 800-53 Control Number and Name | Recommendation Numbers from Table 4-2 | |------------------------------------------------------------------|-------------------------------------------| | AT-2, Security Awareness Training | 2, 5 | | CA-2, Security Assessments | 3 | | CM-6, Configuration Settings | 7 | | CM-7, Least Functionality | 17, 18, 27 | | CM-8, Information System Component Inventory | 6 | | IA-2, Identification and Authentication (Organizational Users) | 25, 26 | | IA-3, Device Identification and Authentication | 9, 11, 12, 13, 14, 16, 21, 28, 29, 30, 31 | | IR-4, Incident Handling | 31 | | RA-3, Risk Assessment | 4, 35 | | SC-1, System and Communications Protection Policy and Procedures | 1 | | SC-12, Cryptographic Key Establishment and Management | 10, 15, 16, 23, 25 | | SC-40, Wireless Link Protection | 8, 28 | | SC-8, Transmission Confidentiality and Integrity | 13, 14, 16, 19, 20, 22, 29 | | SI-2, Flaw Remediation | 33 | | SI-3, Malicious Code Protection | 32 | | SI-5, Security Alerts, Advisories, and Directives | 36 |


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Automation Support for Security Control Assessments_ Software Asset Management:

| 3.2 SWAM Sub-Capabilities and Defect Check Tables and Templates......................................27 | |----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 3.2.1 Foundational Sub-Capabilities and Corresponding Defect Checks...............................28 | | 3.2.2 Data Quality Sub-Capabilities and Corresponding Defect Checks ...............................37 | | 3.2.3 Local Sub-Capabilities and Corresponding Defect Checks ...........................................45 | | 3.2.4 Security Impact of Each Sub-Capability on an Attack Step Model ................................74 | | 3.3 SWAM Control (Item) Security Assessment Plan Narrative Tables and Templates.............82 | | 3.3.1 Outline Followed for Each Control Item........................................................................83 | | 3.3.2 Outline Organized by Baselines......................................................................................83 | | 3.3.3 Low Baseline Security Control Item Narratives .............................................................85 | | 3.3.4 Moderate Baseline Security Control Item Narratives ..................................................115 | | 3.3.5 High Baseline Security Control Item Narratives..........................................................148 | | 3.4 Control Allocation Tables (CATs)......................................................................................165 | | 3.4.1 Low Baseline Control Allocation Table........................................................................166 | | 3.4.2 Moderate Baseline Control Allocation Table...............................................................168 | | 3.4.3 High Baseline Control Allocation Table.......................................................................169 | | Appendix A.

Automation Support for Security Control Assessments_ Software Asset Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to System and Network Security Acronyms and Abbreviations:

ds of electromagnetic radiation to personnel   |
| HF       | high frequency                                      |
| HFS      | Hierarchical File System                            |
| HHS      | U.S.
Department of Health and Human Services        |
| HINFO    | host information                                    |
| HIP      | Host Identity Protocol                              |
| HIPAA    | Health Insurance Portability and Accountability Act |
| HIPERLAN | high-performance radio local area network           |
| HKLM     | HKEY_Local_Machine                                  |
| HL7      | Health Level Seven                                  |
| HMAC     | keyed-hash message authentication code              |
| HMI      | human-machine interface                             |
| HPA      | host protected area                                 |
| HPFS     | High-Performance File System                        |
| HR       | human resources                                     |
| HSARPA   | Homeland Security Advanced Research Projects Agency |
| HSPD     | Homeland Security Presidential Directive            |
| HTCIA    | High Technology Crime Investigation Association     |
| HTCP     | Hyper Text Caching Protocol                         |
| HTML     | Hypertext Markup Language                           |
| HTTP     | Hypertext Transfer Protocol                         |
| HTTPS    | Secure Hypertext Transfer Protocol                  |
| Hz       | hertz                                               |

System and Network Security Acronyms and Abbreviations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Planning?

[Assistant]
According to Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations:

......95                       |
| Table 7. Configuration Management (CM).................................................................................................96                |
| Table 8.
Contingency Planning (CP) ............................................................................................................96        |
| Table 9. Identification and Authentication (IA) ..........................................................................................97             |
| Table 10. Incident Response (IR).................................................................................................................98      |
| Table 11. Maintenance (MA) ......................................................................................................................98      |
| Table 12. Media Protection (MP)................................................................................................................99        |
| Table 13. Physical and Environmental Protection (PE)...............................................................................99                    |
| Table 14. Planning (PL)..............................................................................................................................100 |
| Table 15. Program Management (PM) .....................................................................................................100               |
| Table 16. Personnel Security (PS) .............................................................................................................101       |
| Table 17. PII Processing and Transparency (PT) .......................................................................................102                |
| Table 18. Risk Assessment (RA) ................................................................................................................102       |
| Table 19.

Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to A Review of U.S. and European Security Evaluation Criteria:

| ABSTRACT   | ABSTRACT                                                                                |                |    |    |
|------------|------------------------------------------------------------------------------------------------------------------|----------------|----|----|
| KEY        | WORDS                                                                                |                | 1  | 1  |
| 1 . 0      | INTRODUCTION                                                                                |                |    |    |
| 2 . 0      | TRUSTED SYSTEM EVALUATION CRITERIA                                                                               | COMPUTER       |    |    |
| 3 . 0      | TRUSTED INTERPRETATION                                                                                | NETWORK        |    |    |
| 4 . 0      | TRUSTED MANAGEMENT SYSTEM INTERPRETATION ... | DATABASE       |    |    |
| 5.0        | IT SECURITY CRITERIA - CRITERIA FOR THE EVALUATION OF THE TRUSTWORTHINESS OF INFORMATION TECHNOLOGY (IT) SYSTEMS |                |    |    |
| 6 . 0      | DRAFT TECHNOLOGY SECURITY EVALUATION CRITERIA                                                                    | INFORMATION    |    |    |
| 7.0        | ANALYSIS OF SECURITY CRITERIA SETS ... | AND COMPARISON |    |    |
| 7.1        | U.S. EVALUATION CRITERIA - ORANGE BOOK, RED BOOK,                                                                | SECURITY TDI   |    |    |
| 7.2        | U.S. SECURITY EVALUATION CRITERIA                                                                                | vs.

A Review of U.S. and European Security Evaluation Criteria


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Case Studies in Cyber Supply Chain Risk Management_ Mayo Clinic:

The Mayo Clinic's vendor onboarding process is a critical tool for cyber supply chain risk management. Suppliers are contractually obligated to comply with the Mayo Clinic's information security schedule or demonstrate mitigating controls to account for particular requirements. These requirements include cybersecurity, physical security, and ethical behavior requirements particular to their product or service category group. Many of these requirements are publicly available for potential suppliers to review before engaging the Mayo Clinic iii, iv .

The key focus of the Mayo Clinic's cybersecurity and supply chain incident response plans is the continuation of patient care. A dedicated business continuity team within the SCM manages supply chain resiliency events, which are often first identified by other hospitals and health networks that share the supplier. For instance, when the Illinois Environmental Protection Agency shut down the medical supply sterilization company Sterigenics v  in February 2019, the Mayo Clinic's business continuity team proactively engaged vendors reliant on Sterigenics to identify alternative sourcing. The business continuity team stores safety reserves of critical supplies to mitigate the impact of supply chain disruptions. While most Mayo Clinic facilities leverage high-efficiency 'just-in-time' operations and supply delivery, these reserves may be deployed to any facility in the network.

Case Studies in Cyber Supply Chain Risk Management_ Mayo Clinic


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to High-Performance Computing Security_ Architecture, Threat Analysis, and Security Posture:

ta and perform complex calculations at high speeds is a key part of the Nation's vision for maintaining its global competitive edge. Security is essential to achieving the anticipated benefits of HPC.
HPC systems bear some resemblance to enterprise IT computing, which allows for the effective application of traditional IT security solutions. However, they also have significant differences. An HPC system is designed to maximize performance, so its architecture, hardware components, software stacks, and working environment are very different from enterprise IT. Additionally, most HPC systems serve multiple projects and user communities, leading to more complex security concerns than those encountered in enterprise systems. As such, security solutions must be tailored to the HPC system's requirements. Furthermore, HPC systems are often different from one another due to the evolution of their system designs, the applications they run, and the missions they support. An HPC system frequently has its own unique method of applying security requirements and may follow different security guidance, which can impede the sharing of security solutions and knowledge. This NIST Special Publication aims to standardize and facilitate the sharing of HPC security information and knowledge through the development of an HPC system reference architecture and key components, which are introduced as the basics of the HPC system lexicon. The reference architecture divides an HPC system into four function zones. A zone-based HPC reference architecture captures the most common features across the majority of HPC systems and segues into HPC system threat analysis. Key HPC security characteristics and use requirements are laid out alongside the major threats faced by the system and individual function zones. HPC security postures, challenges, recommendations, and some currently recognized variants are also included.

High-Performance Computing Security_ Architecture, Threat Analysis, and Security Posture


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Computer Security Division 2004 Annual Report:

The  Division  has  had  many  other  accomplishments this past year, including advancing development of our cryptographic standards toolkit, further e-authentication work, expansion of our Cryptographic Module  Validation  Program, development of an IT product security configuration  checklist  program  and  more  work  with digital  forensics  tools  and  methods. We have begun new work, as well as continuing previous work, on several key Internet security protocols -  IPSec, BGP  and  DNSSEC. We  have  also provided  technical  expertise  to  several  U.S. government groups on the security implications of spam e-mail and phishing attacks.

To keep pace with the rate of change in emerging technologies  we  conduct  a  large  of  amount  of research  into  existing  and  emerging  technologies. Some  of  the  many  topics  we  research include  smart  card  infrastructure  and  security, wireless and mobile device security, voice over IP security issues, digital forensics tools  and methods, access control and authorization management, Internet Protocol security, intrusion detection systems, quantum information system security and quantum cryptography and vulnerability analyses. Our research helps fulfill specific needs by the Federal government that would not be easily or reliably filled otherwise.

Many  different  types  of  people  use  ICAT  for  a variety  of  purposes. System  administrators  and computer security officers use ICAT to identify the known  vulnerabilities  (and  patch  information) associated with the software on critical systems. Law enforcement can use ICAT in forensics activities to determine the set of possible vulnerabilities that  a  hacker  might  have  used  to  penetrate  a system. Computer security researchers use ICAT to identify sets of vulnerabilities that have particular characteristics  of  interest. Auditors  can  use  ICAT to  check  to  see  if  particular  vulnerabilities  have been patched in audited systems.

Computer Security Division 2004 Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Guide to Computer Security Log Management:

| 5.3                                                                                | Respond to Identified Events................................................................................. | 5-8                |
|-----------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------|--------------------|
| 5.4                                                                                | Manage Long-Term Log Data Storage .................................................................. | 5-9                |
| 5.5                                                                                | Provide Other Operational Support...................................................................... | 5-10               |
| 5.6                                                                                | Perform Testing and Validation ........................................................................... | 5-10               |
| 5.7                                                                                | Summary.............................................................................................................

Guide to Computer Security Log Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Digital Identity Guidelines_ Identity Proofing and Enrollment:

Digital Identity Guidelines
Identity Proofing and Enrollment

Digital Identity Guidelines
Identity Proofing and Enrollment

Temoshok D, Abruzzi C, Choong YY, Fenton JL, Galluzzo R, LaSalle C, Lefkovitz N,
Regenscheid A, Vachino M (2025) Digital Identity Guidelines: Identity Proofing and
Enrollment. (National Institute of Standards and Technology, Gaithersburg, MD), NIST
Special Publication (SP) NIST SP 800-63A-4. https://doi.org/10.6028/NIST.SP.800-63A-4

Digital Identity Guidelines_ Identity Proofing and Enrollment


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Recommended Cybersecurity Requirements for Consumer-Grade Router Products:

Additional information about this publication is available at https://csrc.nist.gov/pubs/ir/8425/a/final including related content, potential updates, and document history. - Machine-readable asset identification support. Consumer-grade routers serve as a central connection point for networks. Many types of devices will gain access to the local network and usually the internet. Consumer grade routers can be more proactive in managing the cybersecurity of the network when machine-readable asset identifiers are available. While home users could utilize machine-readable asset identification, it is more likely to be useful to small businesses or for routers leased from internet service providers (ISPs). Identification can also go beyond simple inventorying to include device type and firmware version, be extended by concepts like device intent signaling (e.g., the ' manufacturer usage description ' [MUD]) or be used more directly for the management of router devices ' firmware updates. Machine-readable asset identifiers must be developed and used in ways that are privacy preserving. - Interface and functionality minimization for consumer-grade router devices. ' Secureby-design ' principles [SecureByDesign] applied to consumer-grade routers should guide manufacturers to minimize the number of interfaces, both logical and physical and general functionality provided by the router device. The primary functionality of the home router is to provide access to the Internet for devices within the home. Extraneous functions should not be included in this component. For example, configuration may be better managed by another product component (e.g., mobile application). This is not to suggest a product composed of only a router device is necessarily less secure than those that can offload functions to other components.. - Robust network onboarding support from consumer-grade router products.

Recommended Cybersecurity Requirements for Consumer-Grade Router Products


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Guidelines for API Protection for Cloud-Native Systems:

ards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology.
ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations.

Guidelines for API Protection for Cloud-Native Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Cloud Computing Synopsis and Recommendations:

| Hardware Support for Trust........................................................................
| 8-9             |
|                                                                                | 8.5.7                                                                                | Key Management....................................................................................... | 8-9             |
| 9. General Recommendations........................................................................................... | 9. General Recommendations........................................................................................... | 9. General Recommendations...........................................................................................

Cloud Computing Synopsis and Recommendations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Benefits of an Updated Mapping between the NIST Cybersecurity Framework and the NERC Critical Infrastructure Protection Standards provide? (Part 5)

[Assistant]
------|
| Identify   | ID. AM                       | Asset Management                       |
| Identify   | ID. BE                       | Business Environment                   |
| Identify   | ID.
GV                       | Governance                             |
| Identify   | ID.RA                        | Risk Assessment                        |
| Identify   | ID.RM                        | Risk Management Strategy               |
| Identify   | ID.SC                        | Supply Chain Risk Management           |
| Protect    | PR.AC                        | Identity Management and Access Control |
| Protect    | PR.AT                        | Awareness and Training                 |
| Protect    | PR.DS                        | Data Security                          |
| Protect    | PR.IP                        | Information Protection and Procedures  |
| Protect    | PR.MA                        | Maintenance                            |
| Protect    | PR.PT                        | Protective Technology                  |
| Detect     | DE.AE                        | Anomalies and Events                   |
| Detect     | DE.CM                        | Security Continuous Monitoring         |
| Detect     | DE.DP                        | Detection Processes                    |
| Respond    | RS.RP                        | Response Planning                      |
| Respond    | RS.CO                        | Communications                         |
| Respond    | RS.AN                        | Analysis                               |
| Respond    | RS.MI                        | Mitigation                             |
| Respond    | RS.IM                        | Improvements                           |
| Recover    | RC.RP                        | Recovery Planning                      |
| Recover    | RC.IM                        | Improvements                           |
| Recover    | RC.CO                        | Communications                         |

These informative references provide practical suggestions for how organizations can achieve the desired outcome of each Subcategory.

Benefits of an Updated Mapping between the NIST Cybersecurity Framework and the NERC Critical Infrastructure Protection Standards

Planning
System and Services Acquisition
Physical Protection
Awareness and Training
Incident Response
Supply Chain Risk Management
Configuration Management
Maintenance
Security Assessment
System and Communications Protection
Media Protection
Risk Assessment
Audit and Accountability
Personnel Security
Identification and Authentication
Access Control
System and Information Integrity


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Proxy Validation and Verification for Critical AI Systems_ A Proxy Design Process:

Additional information about this publication is available at https://csrc.nist.gov/publications/cswp, including related content, potential updates, and document history.

1. Chemical: Basic chemicals, specialty chemicals, agricultural chemicals, and consumer products
2. Commercial facilities: Entertainment/media, gaming, lodging, outdoor events, public assembly, real estate, retail, and sports leagues
3. Communications: Providers of voice services using interconnected terrestrial, satellite, and wireless transmission systems
4. Critical manufacturing: Metals; machinery; electrical equipment, appliances, and components; and transportation equipment
5. Dams: Critical water retention and control services
6. Defense industrial base: Research, development, production, delivery, and maintenance of military weapons systems, subsystems, and components or parts to meet U.S. military requirements
7. Emergency services: Highly skilled and trained personnel and physical and cyber resources that provide prevention, preparedness, response, and recovery services during day-to-day operations and incident response
8. Energy: Electricity, oil, and natural gas
9. Financial services: Depository institutions, providers of investment products, insurance companies, other credit and financial organizations, and providers of critical financial utilities and services that support these functions

Proxy Validation and Verification for Critical AI Systems_ A Proxy Design Process


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does A Threat Analysis on UOCAVA Voting Systems provide? (Part 5)

[Assistant] | 4 | | 2.1.1 | 2.1.1 | FWAB......................................................................................................................................4 | | | 2.1.2 | 2.1.2 | Electronic Transmission Service.............................................................................................4 | | | 2.1.3 | 2.1.3 | Voting over the Internet...........................................................................................................5 | | | 2.1.4 | 2.1.4 | SERVE.....................................................................................................................................5 | | | 2.1.5 | 2.1.5 | Interim Voting Assistance System ...........................................................................................6 | | | 2.2 | 2.2 | CURRENT UOCAVAVOTING PROCESS...........................................................................

A Threat Analysis on UOCAVA Voting Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Enterprise Impact of Information and Communications Technology Risk_ Governing and Managing ICT Risk Programs Within an Enterprise Risk Portfolio:

| Action                                                                | Description                                                                                |
|-----------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| De-duplicate and combine identical or similar risks                   | An external attacker deploys a remote access tool and uses it to exfiltrate the plans for the company's upcoming merger. External threat actors steal information about marketing plans through malicious code deployed in the sales department. Malicious parties plant a web shell in an external site that enables them to access documents stored in the Legal Affairs shared document folder, resulting in the loss of critical corporate information. |
| Reprioritize according to risk appetite, tolerance, and sensibilities | Since priorities have been established at organization and system levels, it may be necessary to review their collective priority and recommend adjustments to a higher or lower priority.

Enterprise Impact of Information and Communications Technology Risk_ Governing and Managing ICT Risk Programs Within an Enterprise Risk Portfolio


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to National Aeronautics and Space Administration's (NASA) Automated Information Security Handbook:

This National Institute of Standards and Technology Interagency Report (NISTIR) presents the National Aeronautics and Space Administration's (NASA) Automated Information Security Handbook . The Handbook provides NASA's overall approach to automated information systems security including: program goals and objectives, assignment of responsibilities, risk assessment, foreign national access, contingency planning and disaster recovery, awareness training, procurement, certification, planning, and special considerations for microcomputers. | Paraaraoh   |                                                       |                                                       | Pace   |
|-------------|-------------------------------------------------------|-------------------------------------------------------|--------|
|             | c. | Personnel Screening                                   | 3-6    |
|             | d. | Access Protection and Accountability                  | 3-6    |
|             | e. | Compliance Assurance                                  | 3-6    |
|             | f                                                     | Contingency and Disaster Recovery Plans               | 3-7    |
|             | g-                                                    | Approval of Methodologies                             | 3-7    |
| 303         | Risk                                                  | Assessment Process                                    | 3-7    |
| 304         | Protective Measures to Prevent Misuse and Abuse       | Protective Measures to Prevent Misuse and Abuse       | 3-10   |
| 305         | Certification                                         | Process                                               | 3-10   |
|             | a. | New or Modified Applications                          | 3-11   |
|             | b.

National Aeronautics and Space Administration's (NASA) Automated Information Security Handbook


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Guide to Secure Web Services:

| Executive Summary..............................................................................................................ES-1 | Executive Summary..............................................................................................................ES-1 | Executive Summary..............................................................................................................ES-1 | Executive Summary..............................................................................................................ES-1 | |---------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------| | Introduction | | ......................................................................................................................1-1 | | | 1.1 | Authority...................................................................................................................1-1 | Authority...................................................................................................................1-1 | | | 1.2 | Purpose and Scope .................................................................................................1-1 | Purpose and Scope .................................................................................................1-1 | | | 1.3 | Audience..................................................................................................................1-1 | Audience..................................................................................................................1-1 | | | 1.4 | Document Structure.................................................................................................1-2 | Document Structure.................................................................................................1-2 | | | 2.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Directions in Security Metrics Research:

Cryptographic mechanisms are an area where research results exist and bounds on the effort required to breach components could be determined, under specific assumptions. Extending this type of analysis to trust mechanisms is a more challenging problem, but one with significant benefits, if achieved.  Components that rely on certain surety mechanisms, such as authentication modules designed for passwords or biometric modules for fingerprints, lend themselves to certain types of strength analysis (e.g., password space size [Lee08]), and results already exist that could be applied.   Finally, techniques for strength analysis might also be drawn from physical security, such as metrics used by industry to evaluate safe and vault security and identify weaknesses leading to failure [Bla04].


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.2 (NIST 3.3.2)?

[Assistant]
According to Recommendation for Key Management_ Part 1 – General:

3.3.2 Cost of Key Revocation and Replacement... 3.3.2                                                                                | Private Authentication Keys... 3.3.2 Cost of Key Revocation and Replacement

In some cases, the costs associated with changing keys are painfully high.

Recommendation for Key Management_ Part 1 – General


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices:

| APPENDIX A: GLOSSARY OF TERMS............................................................................. A-                                                                                | 1                                                                           |
|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------|
| APPENDIX B: REFERENCES...............................................................................................B-                                                                                | 1                                                                           |
| APPENDIX C: MANAGEMENT AND SUPPORT INFORMATION AND INFORMATION SYSTEMS IMPACT LEVELS................................................................ | 1                                                                           |
| C.1 Recommended Provisional Impact Levels for Management and Support Information Types..................................................................................................................... | 2 7                                                                         |
| C.2 Rationale and Factors for Services Delivery Support Information ...................................

Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Recommendation for Key Derivation Using Pseudorandom Functions:

In keeping with the usual terminology, the output of a key-derivation function is called the derived keying material and may subsequently be segmented into multiple keys. Any disjoint segments of the derived keying material (with the required lengths) can be used as cryptographic keys for the intended algorithms. Two different key-establishment scenarios may use the KDF: one in which multiple parties share the same key-derivation key and are able to separately derive the same keying material, and the other in which one entity derives keying material using a keyderivation key known only to itself and distributes the derived keying material to other entities. When multiple parties share the same key-derivation key, the cryptographic application employing a KDF must define the way to convert (i.e., parse) the keying material into different keys. For example, when 256 bits of keying material are derived, the application may specify that the first 128 bits will be used as a key for a message authentication code and that the second 128 bits will be used as an encryption key for a given encryption algorithm. In the case where a single party derives the keying material, a re-derivation can produce the same keys (when required). - [1] Barker EB, Roginsky AL, Davis R (2020) Recommendation for Cryptographic Key Generation. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-133, Rev. 2. https://doi.org/10.6028/NIST.SP.800-133r2
- [2] Barker EB, Chen L, Roginsky AL, Vassilev A, Davis R (2018) Recommendation for PairWise Key-Establishment Schemes Using Discrete Logarithm Cryptography. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-56A, Rev. 3. https://doi.org/10.6028/NIST.SP.800-56Ar3
- [3] Barker EB, Chen L, Roginsky AL, Vassilev A, Davis R, Simon S (2019) Recommendation for Pair-Wise Key-Establishment Using Integer Factorization Cryptography.

Recommendation for Key Derivation Using Pseudorandom Functions


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Derived PIV Application and Data Model Test Guidelines:

NIST Special Publication (SP) 800-157 contains technical guidelines for the implementation of standards-based,  secure,  reliable,  interoperable  Public  Key  Infrastructure  (PKI)-based  identity credentials that are issued for mobile devices by federal departments and agencies to individuals who  possess  and  prove  control  over  a  valid  Personal  Identity  Verification  (PIV)  Card.  This document, SP 800-166, contains the requirements and test assertions for testing the Derived PIV Application and associated Derived PIV data objects implemented on removable hardware tokens and  within  mobile  devices.  The  tests  reflect  the  design  goals  of  interoperability  and  interface functions.

authentication;  derived  PIV  application;  derived  PIV  application  data  model;  derived  PIV credential; derived test requirements (DTR); FIPS 201; implementation under test (IUT); mobile devices; Personal Identity Verification (PIV); test assertions; token command interface.

This document is targeted at vendors of Derived PIV Applications, issuers of Derived PIV Credentials, and entities that will conduct tests on these applications and credentials. Readers are assumed to have a working knowledge of SP 800-157, FIPS 201 and other PIV guidelines, and applicable technologies. This document is intended to:

Derived PIV Application and Data Model Test Guidelines


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.5 (NIST 3.3.5)?

[Assistant]
According to Application Container Security Guide:

3.3.5 オーケストレータノードの信頼 ... 3.3.5 オーケストレータノードの信頼

環境内のノード間の信頼の維持には特別な注意が必要である。オーケストレータは最も中心となるノードである。脆 弱なオーケストレータの設定は、オーケストレータと他のすべてのコンテナ技術コンポーネントをリスクにさらす可 能性がある。考えられる結果の例としては、以下のようなものがある。

- 不正なホストがクラスタに参加し、コンテナを実行
- 一つのクラスタのホストの侵害が、クラスタ全体に侵害をもたらす。例えば、同じ認証用の鍵ペアが、すべ てのノードで共有されている場合など。
- オーケストレータと DevOps 担当者、管理者、およびホスト間の通信が暗号化されず、認証もされない。

## 3.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Recommendation for Block Cipher Modes of Operation_ Galois_Counter Mode (GCM) and GMAC provide? (Part 5)

[Assistant] 9.2 | 9.2 | OPERATIONAL CONSIDERATIONS ..............................................................................................................23 | | | 10 CONFORMANCE...........................................................................................................................................24 | 10 CONFORMANCE...........................................................................................................................................24 | 10 CONFORMANCE...........................................................................................................................................24 | | | APPENDIX A: IMPORTANCE OF THE UNIQUENESS REQUIREMENTON IVS.....................................25 | APPENDIX A: IMPORTANCE OF THE UNIQUENESS REQUIREMENTON IVS.....................................25 | APPENDIX A: IMPORTANCE OF THE UNIQUENESS REQUIREMENTON IVS.....................................25 | | | APPENDIX B: AUTHENTICATION ASSURANCE...........................................................................................26 | APPENDIX B: AUTHENTICATION ASSURANCE...........................................................................................26 | APPENDIX B: AUTHENTICATION ASSURANCE...........................................................................................26 | | | APPENDIX C: REQUIREMENTS AND GUIDELINES FOR USING SHORT TAGS....................................28 | APPENDIX C: REQUIREMENTS AND GUIDELINES FOR USING SHORT TAGS....................................28 | APPENDIX C: REQUIREMENTS AND GUIDELINES FOR USING SHORT TAGS....................................28 | | | APPENDIX D: PROTECTION AGAINST REPLAY OF MESSAGES.............................................................30 | APPENDIX D: PROTECTION AGAINST REPLAY OF MESSAGES.............................................................30 | APPENDIX D: PROTECTION AGAINST REPLAY OF MESSAGES.............................................................30 | | | APPENDIX E: BIBLIOGRAPHY..........................................................................................................................31 | APPENDIX E: BIBLIOGRAPHY..........................................................................................................................31 | APPENDIX E: BIBLIOGRAPHY..........................................................................................................................31 | | ## NIST Special Publication 800-38D | List of Figures | List of Figures | |------------------------------------------------------------------------------------------------------------------------------------------|-------------------| | Figure 1: GHASH H ( X 1 || X 2 || ...

Recommendation for Block Cipher Modes of Operation_ Galois_Counter Mode (GCM) and GMAC


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Digital Identity Guidelines_ Authentication and Authenticator Management provide? (Part 4)

[Assistant]
at https://csrc.nist.gov/pubs/
sp/800/63/B/4/final, including related content, potential updates, and document history. All comments are subject to release under the Freedom of Information Act (FOIA).
NIST SP 800-63B-4
July 2025

Abstract

Digital Identity Guidelines
Authentication and Authenticator Management

This guideline focuses on the authentication of subjects who interact with government
information systems over networks to establish that a given claimant is a subscriber
who has been previously authenticated. The result of the authentication process may
be used locally by the system performing the authentication or asserted elsewhere in a
federated identity system. This document defines technical requirements for each of the
three authentication assurance levels. The guidelines are not intended to constrain the
development or use of standards outside of this purpose. This publication supersedes
NIST Special Publication (SP) 800-63B. Keywords

authentication; authentication assurance; credential service provider; digital
authentication; passwords. Reports on Computer Systems Technology

The Information Technology Laboratory (ITL) at the National Institute of Standards and
Technology (NIST) promotes the U.S. economy and public welfare by providing technical
leadership for the Nation’s measurement and standards infrastructure. ITL develops
tests, test methods, reference data, proof of concept implementations, and technical
analyses to advance the development and productive use of information technology. ITL’s responsibilities include the development of management, administrative, technical,
and physical standards and guidelines for the cost-effective security and privacy of other
than national security-related information in federal information systems.

Digital Identity Guidelines_ Authentication and Authenticator Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Cell Phone Forensic Tools_ an Overview and Analysis Update:

Figure 1 gives an overview of the hardware characteristics of basic, advanced, and high-end cell phones for display quality, processing and storage capacity, memory and I/O expansion, built-in communications, and video and image capture.  The bottom of the diagram shows the range of cellular voice and data advances from kilobit analog networks, still in use today, to megabit 3 rd generation digital networks in the planning and early deployment stages.  The diagram attempts to illustrate that more capable phones can capture and retain not only more information, but also more varied information, through a wider variety of sources, including removable memory modules, other wireless interfaces, and built-in hardware.  Note that hardware components can and do vary from those assignments made in the diagram and, over time, technology once considered high end or advanced eventually appears in what would then be considered a basic phone.

Cell Phone Forensic Tools_ an Overview and Analysis Update


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations:

| CHAPTER ONE INTRODUCTION.......................................................................................1 | CHAPTER ONE INTRODUCTION.......................................................................................1 | | |----------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------| | 1.1 | BACKGROUND ......................................................................................................2 | | | 1.2 | RELATIONSHIP TO OTHER PUBLICATIONS ..................................................................2 | | | 1.3 | PURPOSE.............................................................................................................3 | | | 1.4 | TARGET AUDIENCE | ................................................................................................3 | | 1.5 | ORGANIZATION OF THIS SPECIAL PUBLICATION | ..........................................................4 | | CHAPTER TWO THE FUNDAMENTALS ..............................................................................5 | CHAPTER TWO THE FUNDAMENTALS ..............................................................................5 | | | 2.1 | ORGANIZATION-WIDE VIEW OF ISCM.........................................................................6 | | | 2.2 | ONGOING SYSTEM AUTHORIZATIONS .....................................................................10 | | | 2.3 | ROLE OF AUTOMATION IN ISCM..............................................................................12 | | | 2.4 | ISCM ROLES AND RESPONSIBILITIES ......................................................................13 | | | CHAPTER THREE THE PROCESS...................................................................................16 | CHAPTER THREE THE PROCESS...................................................................................16 | | | 3.1 | DEFINE ISCM STRATEGY.......................................................................................17 | | | 3.2 | ESTABLISH AN ISCM PROGRAM..............................................................................24 | | | 3.3 | IMPLEMENT AN ISCM PROGRAM.............................................................................30 | | | 3.4 | ANALYZE DATA AND REPORT FINDINGS ..................................................................31 | | | 3.5 | RESPOND TO FINDINGS ........................................................................................33 | | | 3.6 | REVIEW AND UPDATE THE MONITORING PROGRAM AND STRATEGY ............................34 | | | APPENDIX A REFERENCES ...........................................................................................A-1 | APPENDIX A REFERENCES ...........................................................................................A-1 | | | APPENDIX B GLOSSARY..............................................................................................

Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations provide? (Part 2)

[Assistant]
ral agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative.
For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications. ## Authority

This publication has been developed by NIST in accordance with its statutory responsibilities under the Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3551 et seq., Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other federal official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST.

Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Module-Lattice-Based Key-Encapsulation Mechanism Standard:

tional Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-108r1-upd1, Includes updates as of February 2, 2024. https://doi.org/10.6028/NIST.SP. 800-108r1-upd1.
- [17] Barker EB, Chen L, Davis R (2020) Recommendation for key-derivation methods in keyestablishment schemes (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-56C Revision 2. https://doi.org/10.6028/NIST.SP.800-56C r2. - [18] Barker EB, Kelsey JM (2015) Recommendation for random number generation using deterministic random bit generators, (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-90A, Rev. 1. https://doi.org/10.6028/NIST.SP. 800-90Ar1. - [19] Sönmez Turan M, Barker EB, Kelsey JM, McKay KA, Baish ML, Boyle M (2018) Recommendation for the entropy sources used for random bit generation, (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-90B. https://doi.org/10.6028/NIST.SP.800-90B. - [20] Barker E, Kelsey J, McKay K, Roginsky A, Turan MS (2024) Recommendation for random bit generator (RBG) constructions, (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-90C 4pd. https://doi.org/10.6028/NIST.SP.80 0-90C.4pd. - [21] Kelsey J, Chang S, Perlner R (2016) SHA-3 Derived Functions: cSHAKE, KMAC, TupleHash and ParallelHash, (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-185 [or as amended]. https://doi.org/10.6028/NIST.SP.800-1 85. - [22] National Institute of Standards and Technology (2016) Submission requirements and evaluation criteria for the post-quantum cryptography standardization process. Available at https://csrc.nist.gov/CSRC/media/Projects/Post-Quantum-Cryptography/documents/call-f or-proposals-final-dec-2016.pdf.

Module-Lattice-Based Key-Encapsulation Mechanism Standard


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.11 (NIST 3.1.11)?

[Assistant]
According to Guidelines for Managing the Security of Mobile Devices in the Enterprise:

3.1.11. 3.1.11.

Guidelines for Managing the Security of Mobile Devices in the Enterprise


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Likely Exploited Vulnerabilities_ A Proposed Metric for Vulnerability Exploitation Probability:

A Proposed Metric for Vulnerability Exploitation Probability

Mell P, Spring J (2025) Likely Exploited Vulnerabilities: A Proposed Metric for Vulnerability Exploitation Probability. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Cybersecurity White Paper (CSWP) NIST CSWP 41. https://doi.org/10.6028/NIST.CSWP.41

This work presents a proposed security metric to determine the likelihood that a vulnerability has been observed to be exploited. Only a small fraction of the tens of thousands of software and hardware vulnerabilities that are published every year will be exploited. Predicting which ones is important for the efficiency and cost effectiveness of enterprise vulnerability remediation efforts. Currently, such remediation efforts rely on the Exploit Prediction Scoring System (EPSS), which has known inaccurate values, and Known Exploited Vulnerability (KEV) lists, which may not be comprehensive. The proposed likelihood metric may augment EPSS remediation (correcting some inaccuracies) and KEV lists (enabling measurements of comprehensiveness). However, collaboration with industry is necessary to provide necessary performance measurements.

Likely Exploited Vulnerabilities_ A Proposed Metric for Vulnerability Exploitation Probability


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Guidelines for the Authorization of Personal Identity Verification Card Issuers (PCI) and Derived PIV Credential Issuers (DPCI):

Implementation of an [HSPD-12] program exposes an organization to specific risks at the mission level of the organization. The PIV Card is used to establish assurance of an identity, and as such, it must be trusted as a basis for granting access to the logical and physical resources of the organization. Similarly, the Derived PIV Credential is also used to establish the assurance of an identity, and must be trusted as a basis for granting access from mobile devices to the remote IT resources of the organization. Any problem with an issued PIV Card or Derived PIV Credential that undermines this assurance could expose an organization to harm. Furthermore, the collection, processing, and dissemination of personal information is required to issue these credentials and thereby increases the threat of this information being used for malicious purposes 14 if not secured. It is the DAO's responsibility to weigh the risks of these and other security and privacy impacts when making the authorization decision. Furthermore, as [HSPD12] is a government-wide mandate based on a standard of interoperability allowing organizations to accept other organizations' credentials, authorization decisions within a single organization

The evidence that ensures the presence of issuer controls that are derived from FIPS 201-2 requirements and its related documents as well as OMB Memoranda, and verified through appropriate assessments, establishes the capability of the issuer. However, authorization is generally based not merely on the demonstration of capability, but also on the presence of certain organizational characteristics that will provide a high degree of confidence to the Assessor that the demonstrated capabilities will be carried out in a dependable and sustainable manner.

Guidelines for the Authorization of Personal Identity Verification Card Issuers (PCI) and Derived PIV Credential Issuers (DPCI)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Computer Security Division 2015 Annual Report:

ing group has been working on developing a draft of SP 800-173, Guidance for Applying the Risk Management Framework  to  Federal-based  Information  Systems  (target release date: spring/summer 2016).
In response to the rapidly emerging use of virtualization in enterprise data centers for supporting both in-house mission-critical applications and for providing cloud services, two guidance documents  were  published:  Draft  SP  800-125A,  Security Recommendations  for  Hypervisor  Deployment,  and  Draft SP  800-125B, Secure  Virtual  Network  Configuration  for Virtual Machine (VM) Protection. In support of the revised FIPS  201, Personal  Identity  Verification  (PIV)  of  Federal Employees and Contractors, two new PIV-related SP 800-series  were  released  and  five  SP  800  documents were  revised. One  of  the  new  publications,  SP  800-157, Guidelines  for  Derived  Personal  Identity  Verification  (PIV) Credentials,  guides  the  implementation  and  deployment of  PIV  credentials  for  mobile  devices. In  addition,  the  PIV team participated in the Office of Management and Budget (OMB) cybersecurity Sprint effort with a goal to strengthen the  cybersecurity  of  federal  networks,  systems,  and  data through multi-factor authentication using the PIV Card. To improve access to new technologies, the group also chaired, edited, and participated in the development of a wide variety of national and international security standards.

Computer Security Division 2015 Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Guidelines on Securing Public Web Servers:

| Introduction ......................................................................................................................1-1 | | | | | 1.1 | Authority...................................................................................................................1-1 | | | | 1.2 | Purpose and Scope .................................................................................................1-1 | | | | 1.3 | Audience and Assumptions .....................................................................................1-2 | | | | 1.4 Document | Structure.................................................................................................1-2 | | | 2.

Guidelines on Securing Public Web Servers


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Developing Cyber-Resilient Systems_ A Systems Security Engineering Approach:

................................................................. 40
3.2.4   Define and Analyze Specific Alternatives ..................................................................................
43
3.2.5   Develop Recommendations ...................................................................................................... 46

Developing Cyber-Resilient Systems_ A Systems Security Engineering Approach


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Using Business Impact Analysis to Inform Risk Prioritization and Response provide? (Part 3)

[Assistant]
RCID iDs

Stephen D. Quinn: 0000-0003-1436-684X Nahla Ivy: 0000-0003-4741-422X

Matthew Barrett: 0000-0002-7689-427X

Larry Feldman: 0000-0003-3888-027X

Daniel Topper: 0000-0003-2612-7547

Gregory A.
Witte: 0000-0002-5425-1097

## Contact Information

nistir8286@nist.gov

National Institute of Standards and Technology Attn: Applied Cybersecurity Division, Information Technology Laboratory

100 Bureau Drive (Mail Stop 2000) Gaithersburg, MD 20899-2000

## Additional Information

Additional information about this publication is available at https://csrc.nist.gov/pubs/ir/8286/d/upd1/final, including related content, potential updates, and document history. All comments are subject to release under the Freedom of Information Act (FOIA). ## Abstract

While business impact analysis (BIA) has historically been used to determine availability requirements for business continuity, the process can be extended to provide a broad understanding of the potential impacts of any type of loss on the enterprise mission. The management of enterprise risk requires a comprehensive understanding of mission-essential functions (i.e., what must go right) and the potential risk scenarios that jeopardize those functions (i.e., what might go wrong). The process described in this publication helps leaders determine which assets enable the achievement of mission objectives and evaluate the factors that render assets as critical and sensitive. Based on those factors, enterprise leaders provide risk directives (i.e., risk appetite and tolerance) as input to the BIA. System owners then apply the BIA to developing asset categorization, impact values, and requirements for the protection of critical or sensitive assets.

Using Business Impact Analysis to Inform Risk Prioritization and Response


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Attribute-based Access Control for Microservices-based Applications using a Service Mesh:

- An authenticatable runtime identity for services, authenticable credentials for individual users of the service, and encryption of communication between services.
- A Policy Enforcement Point (PEP) that is separately deployable and controllable from the application. The role of Policy Decision Point (PDP) can be filled by the service mesh's sidecar proxies or an external service.
- Logs and metrics for monitoring policy enforcement.

The service mesh's native feature to authenticate end-user credentials attached to the request (e.g., using a Java Web Token [JWT]) is augmented in many offerings to provide the ability to call external authentication and authorization systems on behalf of the application. The capability to deploy these authentication and authorization systems as services in the mesh also provides operational assurances for encryption in transit, identity, a PEP, authentication, and authorization for end-user identity.

- Multiple, loosely coupled microservices communicate through network calls, and these communication links must be protected. In the case of monolithic applications, these communications take place through procedure calls.
- The entire network and all microservices are untrusted. Therefore, mutual authentication and secure communication channels between microservices through mechanisms such as mutual Transport Layer Security (TLS) (mTLS) are required.
- The logging data that pertains to each microservice must be consolidated to obtain a security profile in order for forensics, audits, and analytics to assess the overall health of the application.

Attribute-based Access Control for Microservices-based Applications using a Service Mesh


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Cloud Computing Synopsis and Recommendations:

collaboration between providers and consumers can help ensure that clouds meet specific security conformance and regulatory requirements, especially for those supporting government agency operations.
| Technical                                                                                | Operational                                                                                | Management                                                                                |
|---------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------|
| Access Control Audit and Accountability Identification and Authentication System and Communication Protection | Awareness and Training Configuration and Management Contingency Planning Incident Response Maintenance Media Protection Physical and Environmental Protection Personnel Security System and Information Integrity | Certification, Accreditation and Security Assessment Planning Risk Assessment System and Services Acquisition |

Cloud Computing Synopsis and Recommendations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Guide to Enterprise Patch Management Planning_ Preventive Maintenance for Technology:

- Harden software, such as enforcing the principles of least privilege and least functionality (e.g., deactivating or uninstalling software services, features, and other components that are not needed). For additional information on hardening assets, especially those considered critical, see the NIST publication Security Measures for 'EO-Critical Software' Use Under Executive Order (EO) 14028 (July 9, 2021). - Acquire software that is likely to have fewer vulnerabilities over time compared to other software. - Work with software development partners that are likely to introduce fewer vulnerabilities into software over time, taking into consideration factors such as how rigorous their secure software development practices are, how quickly they address issues and release patches, how often problems are associated with their patches, and how transparent they are in their security-related communications. - Use managed services instead of software when feasible. 1. Will you be releasing updates for this software to address vulnerabilities? 2. Approximately how many patches, updates, and upgrades do you expect to release each year for this software? On average, how quickly do you expect to address each vulnerability and release a patch? Do you bundle patches together or is each patch separate? How often do you anticipate releasing emergency updates? 3. For how many years are you committed to correcting vulnerabilities in the software? 4. Will you release updates on a regular schedule, as needed, or both? If a schedule will be followed, what is that schedule (weekly, monthly, quarterly, etc.)? 5. Do you have a vulnerability disclosure and incident response program for your software? How transparent are you in your security-related communications to your customers? 6. When a vulnerability in your software becomes public but a patch, update, or upgrade is not available, how do you recommend that customers protect their computing assets running your software?

Guide to Enterprise Patch Management Planning_ Preventive Maintenance for Technology


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to A Comparison of Attribute Based Access Control (ABAC) Standards for Data Service Applications_ Extensible Access Control Markup Language (XACML) and N:

An XACML request is a collection of attribute name, value pairs for the subject (user), action (operation), resource, and environment. XACML identifies relevant policies and rules for computing decisions through a search for Targets (conditions that match the attributes of the request). Because multiple Policies in a PolicySet and/or multiple Rules in a Policy may produce conflicting access control decisions, XACML resolves these differences by applying a policy combining algorithm from a set defined by the standard. The entire process includes collecting attributes, matching conditions, computing rules, and resolving conflicts involving at least two data stores. There are two phases of policy evaluation that need to be considered. The first and costliest is loading policy from disk to Policy Decision Point (PDP) main memory, and the second is request evaluation. In both phases, performance is directly related to the number of policies considered. | 4.5                                                                                |                                                                                | Arbitrary Data Service Operations and Policies ............................................

A Comparison of Attribute Based Access Control (ABAC) Standards for Data Service Applications_ Extensible Access Control Markup Language (XACML) and N


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Digital Identity Guidelines provide? (Part 2)

[Assistant]
ral agencies even before the completion of such companion publications. Thus, until
each publication is completed, current requirements, guidelines, and procedures, where
they exist, remain operative.
For planning and transition purposes, federal agencies may
wish to closely follow the development of these new publications by NIST. Organizations are encouraged to review all draft publications during public comment
periods and provide feedback to NIST. Many NIST cybersecurity publications, other than
the ones noted above, are available at https://csrc.nist.gov/publications. Authority

This publication has been developed by NIST in accordance with its statutory
responsibilities under the Federal Information Security Modernization Act (FISMA)
of 2014, 44 U.S.C. § 3551 et seq., Public Law (P.L.) 113-283. NIST is responsible
for developing information security standards and guidelines, including minimum
requirements for federal information systems, but such standards and guidelines shall
not apply to national security systems without the express approval of appropriate
federal officials exercising policy authority over such systems. This guideline is consistent
with the requirements of the Office of Management and Budget (OMB) Circular A-130. Nothing in this publication should be taken to contradict the standards and guidelines
made mandatory and binding on federal agencies by the Secretary of Commerce
under statutory authority. Nor should these guidelines be interpreted as altering or
superseding the existing authorities of the Secretary of Commerce, Director of the
OMB, or any other federal official. This publication may be used by nongovernmental
organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to NIST Privacy Framework_ A Tool for Improving Privacy Through Enterprise Risk Management, Version 1.0:

(2017) An Introduction to Privacy Engineering and Risk Management in Federal Systems. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Interagency or Internal Report (IR) 8062.
https://doi.org/10.6028/NIST.IR.8062
- [6] Joint Task Force Transformation Initiative (2011) Managing Information Security Risk: Organization, Mission, and Information System View. (National Institute of Standards and Technology, Gaithersburg, MD). NIST Special Publication (SP) 800-39. https://doi.org/10.6028/NIST.SP.800-39
- [7] Joint Task Force (2018) Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-37 Rev. 2. https://doi.org/10.6028/NIST.SP.800-37r2
- [8] Grassi PA, Garcia ME, Fenton JL (2017) Digital Identity Guidelines. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-63-3, Includes updates as of December 1, 2017. https://doi.org/10.6028/NIST.SP.800-63-3
- [9] Office of Management and Budget (2017) Preparing for and Responding to a Breach of Personally Identifiable Information. (The White House, Washington, DC), OMB Memorandum M-17-12, January 3, 2017. Available at https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2017/m-17-12\_0.pdf
- [10] Joint Task Force Transformation Initiative (2013) Security and Privacy Controls for Federal Information Systems and Organizations. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-53, Rev. 4, Includes updates as of January 22, 2015. https://doi.org/10.6028/NIST.SP.800-53r4
- [11] Grassi PA, Lefkovitz NB, Nadeau EM, Galluzzo RJ, Dinh AT (2018) Attribute Metadata: A Proposed Schema for Evaluating Federated Attributes. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Interagency or Internal Report (IR) 8112.

NIST Privacy Framework_ A Tool for Improving Privacy Through Enterprise Risk Management, Version 1.0


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Guide to Cyber Threat Information Sharing:

- Indicators are technical artifacts or observables 1 that suggest an attack is imminent or is currently underway or that a compromise may have already occurred. Indicators can be used to detect and defend against potential threats. Examples of indicators include the Internet Protocol (IP) address of a suspected command and control server, a suspicious Domain Name System (DNS) domain name, a Uniform Resource Locator (URL) that references malicious content, a file hash for a malicious executable, or the subject line text of a malicious email message. - Tactics, techniques, and procedures (TTPs) describe the behavior of an actor. Tactics are high-level descriptions of behavior, techniques are detailed descriptions of behavior in the context of a tactic, and procedures are even lower-level, highly detailed descriptions in the context of a technique. TTPs could describe an actor's tendency to use a specific malware variant, order of operations, attack tool, delivery mechanism (e.g., phishing or watering hole attack), or exploit. - Security alerts , also known as advisories, bulletins, and vulnerability notes, are brief, usually humanreadable, technical notifications regarding current vulnerabilities, exploits, and other security issues. Security alerts originate from sources such as the United States Computer Emergency Readiness Team (US-CERT), Information Sharing and Analysis Centers (ISACs), the National Vulnerability Database (NVD), Product Security Incident Response Teams (PSIRTs), commercial security service providers, and security researchers. - Threat intelligence reports are generally prose documents that describe TTPs, actors, types of systems and information being targeted, and other threat-related information that provides greater situational awareness to an organization. Threat intelligence is threat information that has been aggregated, transformed, analyzed, interpreted, or enriched to provide the necessary context for decision-making processes.

Guide to Cyber Threat Information Sharing


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice IA.L2-3.5.4 (NIST 3.5.4)?

[Assistant]
According to Application Container Security Guide:

3.5.4 不適切なユーザアクセス権 ... 3.5.4 不適切なユーザアクセス権

対話型のユーザログオンはまれであるため、コンテナ専用 OS は通常、マルチユーザシナリオをサポートするように は最適化されていない。ユーザがコンテナを管理する目的では、オーケストレーションレイヤを経由してログオンす るよりも、直接ホストにログオンする際に、組織はよりリスクにさらされる。直接管理することで、システムとその 上にあるすべてのコンテナに対する広範な変更が可能になり、特定のアプリのコンテナを管理したいだけのユーザ が、他の多くのコンテナに影響を与えることが潜在的に可能となってしまう。

## 3.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Guidelines on Security and Privacy in Public Cloud Computing provide?

[Assistant]
<!-- image -->

## Guidelines on Security and Privacy in Public Cloud Computing

Wayne Jansen Timothy Grance

## NIST Special Publication 800-144

## Guidelines on Security and Privacy in Public Cloud Computing

Wayne Jansen Timothy Grance

## C  O  M  P  U  T  E  R      S  E  C  U  R  I  T  Y

Computer Security Division Information Technology Laboratory National Institute of Standards and Technology Gaithersburg, MD 20899-8930

December 2011

<!-- image -->

## U.S. Department of Commerce

Rebecca M. Blank, Acting Secretary

## National Institute of Standards and Technology

Patrick D. Gallagher, Under Secretary of Commerce for Standards and Technology and Director

## Reports on Computer Systems Technology

The  Information  Technology  Laboratory  (ITL)  at  the  National  Institute  of  Standards  and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership  for  the  Nation's  measurement  and  standards  infrastructure. ITL  develops  tests, test  methods,  reference  data,  proof  of  concept  implementations,  and  technical  analysis  to advance the development and productive use of information technology. ITL's responsibilities include the development of technical, physical, administrative, and management standards and guidelines for the cost-effective security and privacy of sensitive unclassified  information  in  Federal  computer  systems. This  Special  Publication  discusses ITL's  research,  guidance,  and  outreach  efforts  in  computer  security,  and  its  collaborative activities with industry, government, and academic organizations. National Institute of Standards and Technology Special Publication 800-144 80 pages (December 2011)

Certain  commercial  entities,  equipment,  or  materials  may  be  identified  in  this document  in  order  to  describe  an  experimental  procedure  or  concept  adequately.

Guidelines on Security and Privacy in Public Cloud Computing


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Report on the Block Cipher Modes of Operation in the NIST SP 800-38 Series:

[44] Jonsson J (2006) On the Security of CTR + CBC-MAC. Selected Areas in Cryptography (SAC 2003), eds Nyberg K, Heys HM (Springer, Ottawa, Canada), Lecture Notes in Computer Science 2595, pp. 76-93.
https://doi.org/10.1007/3-540-36492-7\_7
- [45] Joux A (2007) Authentication Failures in NIST version of GCM. Available at https://csrc.nist.gov/csrc/media/projects/block-ciphertechniques/documents/bcm/joux\_comments.pdf
- [46] Joux A, Martinet G, Valette F (2003) Blockwise-Adaptive Attackers Revisiting the (In)Security of Some Provably Secure Encryption Modes: CBC, GEM, IACBC. Advances in Cryptology (CRYPTO 2002), ed Moti Yung (Springer, Santa Barbara, CA), Lecture Notes in Computer Science 2442, pp. 17-30. https://doi.org/10.1007/3-540-45708-9\_2
- [47] Jutla CS (2004) Lower Bound on Linear Authenticated Encryption. Selected Areas in Cryptography (SAC 2004), eds Matsui M, Zuccherato RJ (Springer, Waterloo, Canada), Lecture Notes in Computer Science 3006, pp. 348-360. https://doi.org/10.1007/9783-540-24654-1\_25
- [48] Keller SS, Hall TA (2017) The Galois/Counter Mode (GCM) and GMAC Validation System (GCMVS) with the Addition of XPN Validation Testing. Available at https://csrc.nist.gov/CSRC/media/Projects/Cryptographic-Algorithm-ValidationProgram/documents/mac/gcmvs.pdf

Report on the Block Cipher Modes of Operation in the NIST SP 800-38 Series